ISC2 Blog

It’s Official: (ISC)² Security Congress is Back for the 11th Year in a Row!

Registration for the 11th annual (ISC)² Security Congress is now open! The renowned global three-day conference, focused on continuing education for cybersecurity professionals and information security specialists, will be hosted as a hybrid event for the first time in 2021. Engaging in-person sessions, discussions, and networking events will be held at the Hyatt Regency in Orlando, FL from October 18-20, and will also be accessible online. (ISC)² members are eligible for a special discount of $300 off all pass types. Including an optional two days of pre-conference certification-focused education on October 16-17, (ISC)² members can earn as many as 40... Read more →

Your Next Cybersecurity Hire May Already Be in Your Organization

While spending on security technologies continues to increase, organizations are still fighting an uphill battle against cyber attacks. The primary reason is that the personnel needed to defend organizations is extremely scarce. Currently, the cybersecurity workforce gap estimate stands at more than 3.1 million trained professionals worldwide, and it will take time to close that gap. Organizations aren’t likely to solve the problem by focusing their recruitment strategies solely on finding “all star” cybersecurity leaders who just aren’t available. And when they are available, they are quickly snapped up by organizations that can afford the high salaries they command. (ISC)²... Read more →

Online Proctor Exam Pilot Results

On February 28, 2021, (ISC)² concluded a pilot test that assessed the feasibility of online proctoring for exams that are an essential part of our nine certification programs. Online examinations for the CAP, CCSP, CSSLP, HCISPP, CISSP-ISSAP, CISSP-ISSEP, CISSP-ISSMP and SSCP certifications were administered February 15, 2021 – February 21, 2021. Online CISSP examinations were administered February 22, 2021 – February 28, 2021. For quality control purposes and anticipated candidate support concerns, we elected to offer all exams via online proctor only to candidates physically present within the United States. Since the conclusion of the pilot test, we have been... Read more →

In A Year Like No Other, What Did Yours Look Like? Take The Survey.

The world will never be the same, and neither will cybersecurity. This past year changed everything. Or did it? Help us better understand the current state of the cybersecurity profession. We need your participation in the annual (ISC)² Cybersecurity Workforce Survey. You’re living and working through the changes. Now, share what you’ve experienced. Your feedback will play a vital role in benchmarking the global shifts in cybersecurity through the pandemic and beyond. Example: Most survey respondents last year reported stable — or even fewer — security incidents after moving their cybersecurity teams remote. Did that trend hold up for you... Read more →

Healthcare Privacy–Bigger Than Just HIPAA

Security Without Regulatory Muscle As a security practitioner, you may have worked in an industry that was not affected by any regulatory authority. There was a time when security was not driven by governmental power. In many cases, this is why security did not exist in smaller organizations. The ideology that a company was “not an attractive target” to cybercrime was a cozy pillow upon which many C-Level executives rested their heads. Over the last twenty years, this has changed. In fact, not only has security been codified in law, but privacy has become an even stronger legal tool to... Read more →

More Than Likely, Or Less Than Probable: Is a truly quantitative security analysis possible?

The Language of Profit and Loss Security professionals spend a lot of time honing their area of expertise. Your strength could be in packet analysis, or programming…maybe you are at your best in the realm of security engineering, or pentesting. Or, you may have the best technical skills, but when it comes to obtaining a budget for a project or a new security tool, you need to understand and explain the difference between likelihood, and probability. Why is this important? This is important because the language of business is based on profits and loss, and that component is key to... Read more →

Many Cybersecurity Jobseekers Lack a Full Understanding of the Role They Seek

People looking to get into the cybersecurity field generally demonstrate a solid understanding of the threats facing organizations, according to new research from (ISC)². Yet, they don’t necessarily have the correct expectations of what they will be doing should they land a cybersecurity job. In a profession that covers a wide spectrum of tasks and responsibilities, including security operations, risk assessment and user training, coming up with a clear definition of the role is difficult for outsiders, the study suggests. Nevertheless, job pursuers are aware of the various threats cybersecurity teams have to address, including malware, ransomware and phishing. The... Read more →

What’s Next for Cybersecurity Workers? You Tell Us.

The annual (ISC)² Cybersecurity Workforce Survey needs your experience and opinions to help shape the conversation. As we find ourselves more than one year into a global pandemic, we want to accurately reflect the current state of the industry. How has your career been impacted? How has your organization changed? How has your work evolved? We need to hear from cybersecurity professionals, (ISC)² members and non-members, representing all regions globally. Like last year’s survey results, these results will be used by organizations, governments and the media to foster conversations regarding strategies to improve the recruiting and filling of positions needed... Read more →

Cloud (Mis)Configuration: What Do You Need to Consider?

Should you adopt the default security configuration from your Cloud Service Provider to avoid a misconfiguration incident? If you do, proceed with caution. Some default settings may not be required in your environment and would serve the organization better if they were disabled. As part of a complete cloud security strategy, all settings must be checked against an established hardening standard. CSPs deliver a platform and the tools to manage it. Yet ultimately, it isn’t the responsibility of the CSP to secure your environment. It’s yours. READ THE ARTICLE Read more →

(ISC)² Supports NIST Encouragement of Inclusive Cybersecurity Terminology

Commonly used cybersecurity terms such as “blacklisting” and “whitelisting” may be discontinued if the National Institute of Standards and Technologies (NIST) efforts are successful. The agency wants to eliminate terms with problematic connotations from speech and written documents and replace them with neutral, more precise wording. “Using inclusive language can help people from diverse backgrounds feel more welcome and encourages precise, high quality work,” the agency explains in recently issued guidance document on the matter, NISTIR 8366. The purpose of the effort is threefold: Develop documentary standards Use inclusive language in verbal communication during meetings and negotiations Create documentation on... Read more →

Do You Have These Top Cyber Security Skills?

An interesting take-away from the (ISC)2 Cybersecurity Career Pursuers Study is what cybersecurity professionals told us were the most important technical skills for those looking for their first cybersecurity job. When current jobholders were asked to rate the most important technical skills for aspiring cybersecurity professionals, there was little differentiation among the 20 technical concepts they were asked to rate. Cyber Security Technical Skill or Concept Rating (1 – 5) Cloud Security 4.46 Malware Analysis 4.44 Data Analysis 4.42 Threat Assessment 4.42 Intrusion Detection 4.42 Risk Assessment/Management 4.37 Encryption 4.37 Secure Software Development 4.37 Networking 4.34 Database 4.32 Penetration Testing... Read more →

Creating Secure Software Requires More Than Just Motivation

The Power of Positive Thinking Remember the early days of software programming? There were stories about the solitary programmer, toiling late into the night, (and into the next days and nights), working until the creation was complete. These images were corroborated by people such as Shawn Fanning, the creator of Napster, and Mark Zuckerberg, the creator of Facebook. They had more than a mission; they had a vision, and unceasing motivation. Software development has come a long way from those “lone wolf” days. The alumni of those early days have gone on to greater tasks. While the motivation to create... Read more →

Unlimited Access to Free Industry Leading Cybersecurity Webinars

(ISC)² Webinars are an opportunity to take part in active, educational and engaging sessions delivering up-to-date knowledge from cybersecurity experts. Experienced and vetted professionals lead discussions on industry-relevant topics with four to five live global webcasts per week in addition to recorded content. All webinar subjects are designed with your continuing education in mind, ensuring that sessions are informative and relevant. Each session delivers a discussion of topical items that practitioners face in the field, free of marketing pitches or product-centric discussion. With 13 years of developing content, the (ISC)² team can assure that attendees will receive vendor-neutral content and... Read more →

CISSPs from Around the Globe: An Interview with Jason Lau

The Certified Information Systems Security Professional (CISSP) certification is considered to be the gold standard in information security. This is so because of all the doors that certification opens to a CISSP professional. Those doors lead to many different types of positions and opportunities, thus making the information security community dynamic and multifaceted. In support of this diversity, (ISC)² has launched a series of interviews to explore where CISSP certification has led security professionals. Last time we heard from Mari Aoba and her experiences with CISSP. This installment features Jason Lau, CISO for Crypto.com and an official member and contributor... Read more →

Help Shape The HCISPP Exam

(ISC)² regularly conducts Job Task Analysis (JTA) studies to review and update the content outline (or exam blueprint) of its credentialing examinations. A JTA is the methodical process used to determine tasks that are performed by credential holders and knowledge and skills required to perform those tasks successfully. Results of the JTA study link a candidate’s examination score directly to the domain knowledge being tested. The existing exam blueprint for HCISPP is up next for review! In preparation for that upcoming review, we would like to hear from YOU, our HCISPP members. We want to hear from you on the... Read more →

Keeping Excess Out of Access

How Much Access is Too Much? Many security practitioners grapple with the problem of their colleagues demanding too much access to network resources. Sometimes, it is not just people who request excessive access, it could be an application that needs more access than necessary to function, or it could be a process that is demanding too much access. In some cases, an entire system or network can be the access challenge. Whatever the case may be, there are many methods at the fingertips of the security practitioner to control access in a way that enables a business to function without... Read more →